Android Question For what is SHA1 hash in manifest with google services

KMatle

Expert

Licensed User

Longtime User

• Aug 21, 2016

• #2

Private sign your app (Tools -> Private Sign Key). In the Listbox you'll see the SHA1 Just copy and paste it...

 

Upvote 0

Erel

B4X founder

Staff member

Licensed User

Longtime User

• Aug 21, 2016

• #3

The SHA1 signature ties Google Map key to the private sign key, so only you can use this specific Google Map key.

 

Upvote 0

A

Alessandra Pellegri

Active Member

Licensed User

Longtime User

• Aug 21, 2016

• #4

But what prevents that someone takes the regular sign of my app, substitute it's own with mine and use my key ?
In other words:



What prevents App "C" from working ?
How could I protect me from this ?

 

Upvote 0

DonManfred

Expert

Licensed User

Longtime User

• Aug 21, 2016

• #5

The author of B is not able to sign the app and get it to work in C using your api-key as he does not have your sign-key.

 

Upvote 0

A

Alessandra Pellegri

Active Member

Licensed User

Longtime User

• Aug 21, 2016

• #6

Ok, but the sign is a sequence of bytes. He can take this exact sequence and paste to its own app. It is not the right sign but how google can know this ? Is Android that checks if it is correct ?

 

Upvote 0

An Schi

Well-Known Member

Licensed User

• Aug 21, 2016

• #7

You have to use the identical signkey or google play won't allow you to upload the updated app.

 

Upvote 0

A

Alessandra Pellegri

Active Member

Licensed User

Longtime User

• Aug 21, 2016

• #8

Ok, so if I correctly understand, SHA1 hash protect me from illegal redistributing of my APIKey but the robber can anyway use it for himself. Is it right ?

 

Upvote 0

A

Alessandra Pellegri

Active Member

Licensed User

Longtime User

• Aug 22, 2016

• #9

Alessandra Pellegri said:

Ok, so if I correctly understand, SHA1 hash protect me from illegal redistributing of my APIKey but the robber can anyway use it for himself. Is it right ?

Click to expand...

Is it ?

Thank you

 

Upvote 0

Erel

B4X founder

Staff member

Licensed User

Longtime User

• Aug 22, 2016

• #10

The Google Maps SDK can check the current APK signature and make sure that it matches the signature tied to the API key. It did enforce it in the past, I'm not sure that it still tests it as now the Google Maps free plan is unlimited anyway.

 

Upvote 0

A

Alessandra Pellegri

Active Member

Licensed User

Longtime User

• Aug 22, 2016

• #11

OK, thank you

 

Upvote 0